Hi @sarit_s,
please use stats, something like this:
your_search
| stats values(userScore) AS userScore BY gcid
sorry if I simplified your search in my sample.
Ciao.
Giuseppe
Hi @sarit_s,
please use stats, something like this:
your_search
| stats values(userScore) AS userScore BY gcid
sorry if I simplified your search in my sample.
Ciao.
Giuseppe
Hi @sarit_s,
good for you, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉